REMARKS 



Claims 1-33 were presented for examination and were rejected. Applicants are 
hereby canceling claims 18-19; and amending claims 1, 2, 12, 13, 20-22, 27, 28, and 
30-33. Support for all amendments is found In the application as originally filed. 
Reconsideration of this application as amended, and allowance of all claims remaining 
herein, claims 1-17 and 20-33 as amended, are hereby respectfully requested. 

On the Office Action Summary, item 10, the Examiner did not indicate whether 
he accepted the drawings that were filed on October 29, 2001, or whether he is 
objecting to them. The Examiner is hereby requested to indicate in his next Office 
Action whether he is accepting said drawings as fully compliant formal drawings 

The Examiner rejected claims 1-10 and 12-33 under 35 U.S.C. §1 02(e) as being 
anticipated by Bates . In response to this rejection. Applicants are hereby amending 
claims 1, 2, 12, 13, 20-22, 27, 28, and 30-33 to more particularly point out the subject 
matter of their invention. As amended, Applicants' claims are patentably distinct over 
the prior art, for the following reasons. 

In general. Bates is directed to a non-real-time method for preventing viral 
outbreaks, whereas Applicants' invention pertains to real-time methods (and 
corresponding apparati and computer-readable media) for minimizing damage caused 
by actual outbreaks of computer viruses. As used herein, "computer virus" broadly 
includes any and all types of malicious computer code. 

Independent claim 1 recites that the first computer virus status mode is entered 
"in response to a first computer virus outbreak report." This implies that there has been 
an outbreak of a computer virus (as that term is broadly defined). There is no such 
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outbreak of a computer virus in Bates . The passage of Bates cited by the Examiner on 
this point (column 1, lines 13-52) is irrelevant, because said passage is a discussion of 
the prior art. 

Secondly, claim 1 as amended recites that the first computer virus alert time is 
generated "automatically." This is in sharp contrast to the time entry cited by the 
Examiner in Bates (Figure 7, item 214), which is a manual (non-automatic) entry 
entered by a human to help categorize whether a certain file should be considered to 
be trustworthy or untrustworthy. The passage in Bates (column 7, lines 20-35) cited by 
the Examiner is not relevant to this issue. 

The last two clauses of claim 1 as amended recite that the first computer virus 
alert time is used in a "real time" determination as to whether the computer content will 
be executed. This differs from Bates in the following respects. Looking at the passage 
of Bates cited by the Examiner (column 12, lines 59-65), it is evident that Bates ' 
timestamp is used only to determine whether the file that is being inspected has been 
changed. If so, it will be virus-scanned. Time information in Bates is used to create 
virus status information that is stored on a remote server 30 (not within the confines of 
the network being protected as In the present invention). This virus status information 
is used subsequently (not in real time as recited in Applicants* claim 1) to determine 
whether the file is safe to execute or not. 

Similar amendments are being made herein to Applicants' other independent 
claims. For example, claim 12, which is an independent apparatus claim, is being 
amended to recite "automatically recovering a preselected virus access control time 
corresponding to said virus status mode." There is nothing resembling this in Bates. 
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other points of novelty in Applicants* independent clainns include the firewall 
module of claim 30 and the firewall means of claim 33. A firewall is not suggested in 

Bates . 

For the above reasons, Applicants' independent claims are patentably distinct 
over the prior art, including Bates . 

The patentability of Applicants' dependent claims follows from the patentability of 
Applicants' independent claims. In addition, Applicants' dependent claims contain 
numerous additional novel features that are not suggested by the prior art. For 
example, claim 3 recites that the first access control time is a relative time stamp. The 
relative time stamp overcomes the problems of time disparity among different 
computers on the network, insuring that all said computers receive uniform protection. 
Specification page 4, paragraph 0010. This relative time stamp is not suggested by the 
prior art. 

Claims 7, 17, and 21 recite a hash value used to identify computer content. 
Bates does not suggest a hash value. His CRC is not a hash value. Column 12, lines 
55-58. 

Claim 24 recites second, third, and fourth control parameters, which enable a 
huge degree of granularity in defending an enterprise network against real time attacks 
of malicious computer code. These parameters are not suggested by Bates . 

For the above reasons, the Examiner is requested to withdraw his rejection of 
claims 1-10 and 12-33; and to allow claims 1-10, 12-17, and 20-33 as amended. 

The Examiner rejected claim 1 1 under 35 U.S.C. §103(a) as being unpatentable 
over Bates in view of Norton Antivirus Corporate Edition (hereinafter " Norton "). 

Applicants traverse this rejection. 
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The Examiner cites Norton for the recitations of "rennoving the computer content 
from the E-mail body" and "denying execution of the computer content." However, the 
passages of Norton cited by the Examiner do not support these recitations. The 
passage on page 15 of Norton states: "If the file is cleaned, the virus is successfully 
and completely removed from the file," i.e., Norton uses the word "removed." However, 
Norton says that the virus is removed, not that the computer content is removed as 
recited in claim 1 1 . 

Similarly, the passage at page 22 of Norton fails to suggest "removing the 
computer content from the E-mail body." In fact, the passage at page 22 teaches away 
from this recitation, because it states: "Norton Antivirus scans only the attachments 
associated with email. There is no need to scan the message itself, as mail messages 
are not subject to computer viruses." 

Similarly, the two passages of Norton cited by the Examiner do not suggest the 
recitation of denying execution of the computer content. 

For the above reasons, the Examiner is requested to withdraw his rejection of 
claim 1 1 ; and to allow claim 1 1 as amended (by virtue of the fact that claim 1 1's parent 
claim 1 is being amended). 

Applicants believe that this application is now in condition for allowance of all 
claims remaining herein, claims 1-17 and 20-33 as amended, and therefore an early 
Notice of Allowance is respectfully requested. If the Examiner disagrees or believes 
that for any other reason direct contact with the Applicants' attorney would help 
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advance the prosecution of this case to finality, he is invited to telephone the 
undersigned at the number given below. 



SONNENSCHEIN NATH & ROSENTHAL LLP 
P. 0. Box 061080 

Wacker Drive Station, Sears Tower 
Chicago, Illinois 60606-1080 
(415) 882-2402 

cc: SYMPOL 

IP/T docketing CH 



Respectfully submitted, 





Edward J. Radio 
Attorney of Record 
Reg. No. 26,793 
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